News / 14-06-2022 / Hong Kong

In June 2022, LCX, a prominent centralised cryptocurrency exchange based in Liechtenstein, effected legal service upon anonymous hackers through the use of NFT.  LCX had earlier in the year lost almost US$8 million worth of various cryptocurrencies to anonymous hackers.  

While this type of theft and fraud has become commonplace, the legal methodologies employed by LCX showcase the multi-jurisdictional nature of legal remedies.  We explore these from a Hong Kong law perspective below.

Brief Factual Overview

After losing almost US$8 million of various cryptocurrencies in January 2022, LCX managed to freeze approximately 60% of the stolen assets as of June 2022.

A brief synopsis of the steps taken include:

1. Partial tracing of cryptocurrencies including those laundered through a crypto mixer
2. International law enforcement collaboration in various jurisdictions including Liechtenstein, Ireland, Spain and USA
3. Court order from Liechtenstein freezing 500 ETH in an account held at Coinbase Europe
4. Court order from the Supreme Court of New York freezing 1.3 million USDC and executed by the Centre Consortium
5. Legal service of court documents upon anonymous hackers via NFT

Crypto Tracing and Mixers

One of the most difficult parts of tracing stolen cryptocurrency is when assets are transferred not only from one wallet to another, but also put through a mixer protocol which obscures the on-chain link between wallets.

This is what occurred with the cryptocurrency stolen from LCX which consisted of Ethereum (ETH).  The fraudsters took the stolen ETH and deposited some or all of it into a crypto mixer, Tornado Cash, which uses a smart contract to accept ETH deposits from various different users depositing different amounts of ETH.  Users (including the fraudsters) would then withdraw their ETH at different times in varying amounts to new wallet addresses.  All of this is intended to obfuscate tracing through the public ledger.

Despite the difficulties arising from mixing, LCX were able to trace part of the stolen cryptocurrency into various wallets held in different cryptocurrency exchanges.  It has not been revealed how LCX conducted its tracing and this remains a difficult area for cryptocurrency tracing and recovery.  At present, there is no clear judicial or statutory guidance in Hong Kong or elsewhere as to what rules of tracing apply when dealing with stolen cryptocurrency mixed with other cryptocurrency unrelated to the fraud.

Some jurisdictions consider the Poison and Haircut approach to be most appropriate whereby mixing would result in all assets becoming tainted.  For example, 3 stolen ETH mixed with 7 clean ETH would result in a 30% taint for each of the 10 ETH withdrawn from the mixer.  This brings about certain difficulties as under this approach, a victim would have to pursue all 10 ETH rather than just the original 3 stolen ETH.

A simpler approach exists in common law jurisdictions.  For over 200 years, courts in common law jurisdictions, such as Hong Kong, have tackled the issue of mixed assets by applying a First-In First-Out (FIFO)  approach as first adopted in Devaynes v Noble (1816) 35 ER 781 (also known as Clayton’s Case). 

The rule in Clayton’s Case is well-settled law in Hong Kong although the courts have in certain circumstances cautioned against its usage where its application would be “unjust and impracticable”.  In the case of The Council of the Law Society of Hong Kong v Cheng Chun Chong & Anor [2018] 4 HKLRD 728, the Hong Kong court stated that it would take only a very small counterweight to displace the rule in Clayton’s Case.  In some circumstances, the pro rata approach may be more appropriate. 

Local Law Enforcement Action

As part of the tracing and recovery process, it is important to consider what appropriate legal measures should be taken in the right jurisdiction to freeze the traced assets.  It goes without saying that the number one priority in fraud is generally to preserve assets so that there is sufficient time for victims to pursue appropriate legal remedies.

LCX discovered that some of the stolen ETH was deposited into Coinbase Europe which is operated as a regulated entity in Ireland.  Law enforcement in both Liechtenstein and Ireland took steps to freeze the assets.

If the stolen ETH was deposited into a wallet held by an exchange or individual in Hong Kong, local law enforcement would have been in a position to render assistance, primarily utilizing the Organized and Serious Crimes Ordinance (Cap. 455) (OSCO) which makes it an offence in Hong Kong for a person to deal with property that they know or suspect to represent proceeds of crime unless they receive appropriate consent from law enforcement. 

In the case of Yan Yu Ying v Leung Wing Hei  [2021] HKCFI 3160, the Hong Kong police issued a Letter of No Consent  to various banks and other companies which, under threat of criminal repercussions, practically froze the 999 Bitcoins in dispute and gave time to the applicant to seek a formal court order. 

Court Freezing Orders

It is important to note that LCX obtained two separate freezing orders in two different jurisdictions.

Firstly, LCX obtained a court order from Liechtenstein freezing 500 ETH in an account held at Coinbase Europe.  This is somewhat unusual given that Coinbase Europe is operated through an entity based in Ireland.  Generally speaking, a court order from one jurisdiction (i.e. Liechtenstein) is not automatically enforceable in another (i.e. Ireland).  In any event, it appears Coinbase Europe was content to abide by and give effect to the Liechtenstein order by freezing the 500 ETH held in its user’s wallet.

Secondly, LCX obtained a court order from the Supreme Court of New York which allowed the Centre Consortium to freeze 1.3 million USDC.  This was possible due to the Centre Consortium being in full centralized control of all issued USDC.  Such freeze would not have been possible against a decentralized cryptocurrency, such as Bitcoin, which has no central authority.

In Hong Kong, similar to many other common law jurisdictions, it is not necessary to conclusively prove ownership of the stolen cryptocurrencies in order for a victim to seek a freezing order, whether it is in the form of a Mareva or proprietary injunction.  The court only requires that the applicant demonstrates a seriously arguable case.  In cases of fraud where the applicant claims ownership of stolen assets, the Court will not require the applicant to demonstrate likelihood of dissipation as this can be inferred from fraud.

Service of Legal Documents via NFT

It goes without saying that in most jurisdictions, all parties affected by a freezing order must be properly notified.  This includes the anonymous hackers.  The question is how do you effect legal service documents upon unknown individuals?

The legal team at LCX came up with a novel approach which was ultimately endorsed by the Supreme Court of New York.  LCX created a “service token” and “airdropped” the NFT into a wallet, presumably one which LCX could demonstrate was accessible by the anonymous hackers.  The service token contained a link to legal documents, including the TRO. 

While the Courts in Hong Kong have not specifically endorsed legal service via NFT, it is theoretically possible to do so.  Pursuant to Order 65, rule 4 of the Rules of the High Court (Cap. 4A), if the Court considers it is impracticable for any reason to serve a document as normally prescribed, the Court may make an order for substituted service.  The main criteria is that the substituted service steps has reasonable prospects to bring the documents to the knowledge of the served party.

Conclusion

Cryptocurrency fraud and asset tracing continues to be a multi-jurisdictional exercise requiring coordinated efforts between the victim’s legal team, local law enforcement and judicial intervention.  In appropriate cases, the Hong Kong courts possess all of the necessary legal tools and remedies to give appropriate relief to victims of fraud.